In Magento security scan I got the below message for my Magento instance:

XS Vulnerability - Failed. XSS Patch not detected (APPSEC-2143)

I am using Magento 2.2.3

How could I resolve this?

Is anyone have an idea about it?


I am able to fix by below patch

diff --git a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml index b20da68..26ef484 100644 --- a/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml +++ b/vendor/magento/module-swagger/view/frontend/templates/swagger-ui/index.phtml @@ -58,7 +58,7 @@ $schemaUrl = $block->getSchemaUrl(); <div class="swagger-ui-wrap"> <a id="logo" href="http://swagger.io">swagger</a> <form id='api_selector'> - <input id="input_baseUrl" type="hidden" value="<?= /* @escapeNotVerified */ $schemaUrl ?>"/> + <input id="input_baseUrl" type="hidden" value="<?= $block->escapeUrl($schemaUrl) ?>"/> <div class='input'><input placeholder="api_key" id="input_apiKey" name="apiKey" type="text"/></div> <div class='input'><a id="explore" href="#" data-sw-translate>apply</a></div> </form>

Hope it will help some one

  • Thanks for your help. I tried the same in my instance and again check it with Magento Scanner but it is giving the same error. is there any other way? – Utsav Gupta Aug 14 at 6:37
  • have you confirm that patch applied? – Sunil Patel Aug 14 at 8:12
  • Thanks for this answer, I spent 6 hours debugging the issue and finally fixed it. By the way I'm using Magento 2.2.5 this will help future Magento fellow people that you should patch this Magento swagger file and update the value to <?= $block->escapeUrl($schemaUrl) ?>. Thanks! – MazeStricks Sep 16 at 13:47

This is fixed in 2.2.7 so have you considered an upgrade?

Although a custom theme can also cause this. Therefore you could go through an upgrade and still get the warning.

Try the upgrade on a public dev store if you can and try and scan this store first.

  • Thanks, @Dominic Xigen for your response, but we do not wanna upgrade version, is there any other way? – Utsav Gupta Aug 14 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.